[MDEV-26061] MariaDB server crash at Field::set_default - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Blocker
Resolution: Fixed
Affects Version/s: 10.2(EOL), 10.3(EOL), 10.4(EOL), 10.5, 10.6
Fix Version/s: 10.2.44, 10.3.35, 10.4.25, 10.5.16, 10.6.8, 10.7.4
Component/s: Virtual Columns
Labels:
- crash
Environment:
Linux 5.4.0-39-generic #43-Ubuntu SMP Fri Jun 19 10:28:31 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

Description

Steps to reproduce:

CREATE TEMPORARY TABLE v0 ( v2 TIMESTAMP CHECK ( DEFAULT ( v2 ) IS NOT TRUE ) , v1 TIMESTAMP ) AS SELECT DISTINCT 'x' AS v3 WINDOW CHECKSUM AS ( ) ;

Reported by:

Yaoguang Chen of Ant Security Light-Year Lab

Backtrace:

Core was generated by `/home/supersix/fuzz/security/MariaDB/install/bin/mysqld --defaults-file=/home/s'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=0xb)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

[Current thread is 1 (Thread 0x7f154c17f300 (LWP 1992265))]

gdb-peda$ #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=0xb)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

#1  0x00005640d742e98f in my_write_core (sig=sig@entry=0xb)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/mysys/stacktrace.c:424

#2  0x00005640d5e9b583 in handle_fatal_signal (sig=<optimized out>)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/signal_handler.cc:344

#3  <signal handler called>

#4  0x00005640d5dfe617 in Field::set_default (this=0x61d0000b9ab8)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/field.cc:2591

#5  0x00005640d5f553a6 in Item_default_value::calculate (this=0x6190000f5240)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item.cc:9468

#6  0x00005640d5f55466 in Item_default_value::val_real (this=0x6190000f5240)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item.cc:9486

#7  0x00005640d5bbf3bb in Type_handler_real_result::Item_val_bool (

    this=<optimized out>, item=<optimized out>)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql_type.cc:5080

#8  0x00005640d5fa186c in Item_func_truth::val_bool (this=0x6190000f5370)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item_cmpfunc.cc:1165

#9  Item_func_truth::val_int (this=0x6190000f5370)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item_cmpfunc.cc:1188

#10 0x00005640d5966058 in TABLE::verify_constraints (this=0x6190000f4698,

    ignore_failure=<optimized out>)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/table.cc:6155

#11 0x00005640d5966bbd in TABLE_LIST::view_check_option (this=0x62b000085498,

    thd=<optimized out>, ignore_failure=<optimized out>)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/table.cc:6128

#12 0x00005640d5476284 in select_insert::send_data (this=0x62b0000871f0,

    values=...)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql_insert.cc:4061

#13 0x00005640d576aafa in select_result_sink::send_data_with_check (

    u=0x62b0000823d0, sent=0x0, items=..., this=0x62b0000871f0)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql_class.h:5609

#14 select_result_sink::send_data_with_check (sent=0x0, u=0x62b0000823d0,

    items=..., this=0x62b0000871f0)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql_class.h:5599

#15 JOIN::exec_inner (this=0x62b000087340)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql_select.cc:4592

#16 0x00005640d576bd20 in JOIN::exec (this=0x62b000087340)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql_select.cc:4504

#17 0x00005640d5762338 in mysql_select (thd=0x62b00007e218,

    tables=<optimized out>, fields=..., conds=<optimized out>, og_num=0x0,

    order=<optimized out>, group=0x0, having=0x0, proc_param=0x0,

    select_options=0x20080040b01, result=0x62b0000871f0, unit=0x62b0000823d0,

    select_lex=0x62b000086138)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql_select.cc:4982

#18 0x00005640d5764425 in handle_select (thd=thd@entry=0x62b00007e218,

    lex=lex@entry=0x62b000082308, result=result@entry=0x62b0000871f0,

    setup_tables_done_option=setup_tables_done_option@entry=0x0)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql_select.cc:544

#19 0x00005640d588eb96 in Sql_cmd_create_table_like::execute (

    this=<optimized out>, thd=0x62b00007e218)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql_table.cc:11746

#20 0x00005640d5591a67 in mysql_execute_command (thd=<optimized out>,

    is_called_from_prepared_stmt=<optimized out>)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql_parse.cc:5995

#21 0x00005640d55508dd in mysql_parse (thd=0x62b00007e218,

    rawbuf=<optimized out>, length=<optimized out>,

    parser_state=<optimized out>)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql_parse.cc:8028

#22 0x00005640d55862a4 in dispatch_command (command=COM_QUERY,

    thd=0x62b00007e218, packet=<optimized out>, packet_length=<optimized out>,

    blocking=<optimized out>)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql_class.h:233

#23 0x00005640d558b704 in do_command (thd=0x62b00007e218,

    blocking=blocking@entry=0x1)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql_parse.cc:1406

#24 0x00005640d5a4b14d in do_handle_one_connection (connect=<optimized out>,

    put_in_cache=<optimized out>)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql_connect.cc:1410

#25 0x00005640d5a4c807 in handle_one_connection (arg=arg@entry=0x608005322038)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql_connect.cc:1312

#26 0x00005640d6897ef0 in pfs_spawn_thread (arg=0x617000005118)

    at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/storage/perfschema/pfs.cc:2201

#27 0x00007f155f9fb609 in start_thread (arg=<optimized out>)

    at pthread_create.c:477

#28 0x00007f155f5cf293 in clone ()

    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

gdb-peda$ quit

Attachments

Issue Links

is duplicated by

MDEV-26424 MariaDB server crash in Field::set_default

Closed

MDEV-26429 MariaDB Server SEGV issue

Closed

MDEV-26430 MariaDB Server SEGV issue

Closed

MDEV-26435 MariaDB Server SEGV issue

Closed

MDEV-26436 MariaDB Server SEGV issue

Closed

relates to

MDEV-10352 Server crashes in Field::set_default on CREATE TABLE

Closed

MDEV-18216 Server crashes in Query_arena::set_query_arena upon CREATE VIEW

Confirmed

MDEV-21028 Server crashes in Query_arena::set_query_arena upon SELECT from view

Closed

links to

CVE-2022-27381

(3 relates to, 1 links to)

Activity

Descending order - Click to sort in ascending order

Alice Sherepa added a comment - 2021-08-25 09:12 - edited

test case from ~~MDEV-26435~~, with ALTER

CREATE TABLE t1 ( v1 TIMESTAMP ) ;

ALTER TABLE t1 ADD COLUMN t1 TEXT DEFAULT ( DEFAULT ( v1 ) ) ;

10.2 1f1d5606e08c928e3da98b
#3 <signal handler called>
#4 Field::set_default (this=0x7fb774038f58) at /10.2/src/sql/field.cc:2457
#5 0x0000564d85bd09a1 in Item_default_value::calculate (this=0x7fb774038e48) at /10.2/src/sql/item.cc:9040
#6 0x0000564d85bd0b53 in Item_default_value::save_in_field (this=0x7fb774038e48, field_arg=0x7fb774037ba8, no_conversions=false) at /10.2/src/sql/item.cc:9084
#7 0x0000564d85a35bc0 in TABLE::update_default_fields (this=0x7fb774036ea0, ignore_errors=true) at /10.2/src/sql/table.cc:7879
#8 0x0000564d859f8bb7 in mysql_alter_table (thd=0x7fb774000d90, new_db=0x7fb774012e48 "test", new_name=0x0, create_info=0x7fb7c2038250, table_list=0x7fb774012828, alter_info=0x7fb7c20381a0, order_num=0, order=0x0, ignore=false) at /10.2/src/sql/sql_table.cc:9609
#9 0x0000564d85a77c6c in Sql_cmd_alter_table::execute (this=0x7fb774013180, thd=0x7fb774000d90) at /10.2/src/sql/sql_alter.cc:333
#10 0x0000564d85924cdc in mysql_execute_command (thd=0x7fb774000d90) at /10.2/src/sql/sql_parse.cc:6017
#11 0x0000564d85929b42 in mysql_parse (thd=0x7fb774000d90, rawbuf=0x7fb774012708 "ALTER TABLE t1 ADD COLUMN t1 TEXT DEFAULT ( DEFAULT ( v1 ) )", length=60, parser_state=0x7fb7c2039560, is_com_multi=false, is_next_command=false) at /10.2/src/sql/sql_parse.cc:7793
#12 0x0000564d85917d9d in dispatch_command (command=COM_QUERY, thd=0x7fb774000d90, packet=0x7fb774008b61 "ALTER TABLE t1 ADD COLUMN t1 TEXT DEFAULT ( DEFAULT ( v1 ) ) ", packet_length=61, is_com_multi=false, is_next_command=false) at /10.2/src/sql/sql_parse.cc:1827
#13 0x0000564d85916898 in do_command (thd=0x7fb774000d90) at /10.2/src/sql/sql_parse.cc:1381
#14 0x0000564d85a72661 in do_handle_one_connection (connect=0x564d896e1d30) at /10.2/src/sql/sql_connect.cc:1336
#15 0x0000564d85a723c6 in handle_one_connection (arg=0x564d896e1d30) at /10.2/src/sql/sql_connect.cc:1241
#16 0x0000564d8629bec4 in pfs_spawn_thread (arg=0x564d896c4ff0) at /10.2/src/storage/perfschema/pfs.cc:1869
#17 0x00007fb7c8214609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#18 0x00007fb7c7def293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

from ~~MDEV-26430~~

CREATE TABLE t1 (v1 TIMESTAMP, a INT NULL CHECK (ceil(DEFAULT (v1)) = NULL)) ;

INSERT t1 VALUES (NULL ,0) ;

10.2 1f1d5606e08c928e3da98b
#3 <signal handler called>
#4 Field::set_default (this=0x7f833c035440) at /10.2/src/sql/field.cc:2457
#5 0x0000558dc2f009a1 in Item_default_value::calculate (this=0x7f833c035158) at /10.2/src/sql/item.cc:9040
#6 0x0000558dc2f00a34 in Item_default_value::val_real (this=0x7f833c035158) at /10.2/src/sql/item.cc:9052
#7 0x0000558dc2f548bc in Item_func_ceiling::real_op (this=0x7f833c0352b8) at /10.2/src/sql/item_func.cc:2382
#8 0x0000558dc2f5484a in Item_func_ceiling::int_op (this=0x7f833c0352b8) at /10.2/src/sql/item_func.cc:2370
#9 0x0000558dc2f4ea08 in Item_func_hybrid_field_type::val_real (this=0x7f833c0352b8) at /10.2/src/sql/item_func.cc:905
#10 0x0000558dc2f1304c in Arg_comparator::compare_real_fixed (this=0x7f833c035678) at /10.2/src/sql/item_cmpfunc.cc:934
#11 0x0000558dc2f27554 in Arg_comparator::compare (this=0x7f833c035678) at /10.2/src/sql/item_cmpfunc.h:87
#12 0x0000558dc2f159a7 in Item_func_eq::val_int (this=0x7f833c0355b8) at /10.2/src/sql/item_cmpfunc.cc:1806
#13 0x0000558dc2d5f624 in TABLE::verify_constraints (this=0x7f833c175dc0, ignore_failure=false) at /10.2/src/sql/table.cc:5303
#14 0x0000558dc2d5f517 in TABLE_LIST::view_check_option (this=0x7f833c0127e8, thd=0x7f833c000d90, ignore_failure=false) at /10.2/src/sql/table.cc:5280
#15 0x0000558dc2c26f9e in mysql_insert (thd=0x7f833c000d90, table_list=0x7f833c0127e8, fields=..., values_list=..., update_fields=..., update_values=..., duplic=DUP_ERROR, ignore=false) at /10.2/src/sql/sql_insert.cc:1042
#16 0x0000558dc2c4e638 in mysql_execute_command (thd=0x7f833c000d90) at /10.2/src/sql/sql_parse.cc:4217
#17 0x0000558dc2c59b42 in mysql_parse (thd=0x7f833c000d90, rawbuf=0x7f833c012708 "INSERT t1 VALUES (NULL ,0)", length=26, parser_state=0x7f839446a560, is_com_multi=false, is_next_command=false) at /10.2/src/sql/sql_parse.cc:7793
#18 0x0000558dc2c47d9d in dispatch_command (command=COM_QUERY, thd=0x7f833c000d90, packet=0x7f833c008b61 "INSERT t1 VALUES (NULL ,0) ", packet_length=27, is_com_multi=false, is_next_command=false) at /10.2/src/sql/sql_parse.cc:1827
#19 0x0000558dc2c46898 in do_command (thd=0x7f833c000d90) at /10.2/src/sql/sql_parse.cc:1381
#20 0x0000558dc2da2661 in do_handle_one_connection (connect=0x558dc5689d10) at /10.2/src/sql/sql_connect.cc:1336
#21 0x0000558dc2da23c6 in handle_one_connection (arg=0x558dc5689d10) at /10.2/src/sql/sql_connect.cc:1241
#22 0x0000558dc35cbec4 in pfs_spawn_thread (arg=0x558dc566cfd0) at /10.2/src/storage/perfschema/pfs.cc:1869
#23 0x00007f8399de5609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#24 0x00007f83999c0293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

CREATE TABLE t1 ( v1 TIMESTAMP, a INT CHECK (DEFAULT (v1) = NULL) ) ;

INSERT t1 VALUES ( NULL , 0 ) ;

10.2 1f1d5606e08c928e3da98b
#3 <signal handler called>
#4 Field::set_default (this=0x7efccc0355b8) at /10.2/src/sql/field.cc:2457
#5 0x000055ef96d479a1 in Item_default_value::calculate (this=0x7efccc035158) at /10.2/src/sql/item.cc:9040
#6 0x000055ef96d47ac6 in Item_default_value::get_date (this=0x7efccc035158, ltime=0x7efd22b98270, fuzzydate=33554433) at /10.2/src/sql/item.cc:9070
#7 0x000055ef96d2dfc6 in Item::get_date_with_conversion (this=0x7efccc035158, ltime=0x7efd22b98270, fuzzydate=33554433) at /10.2/src/sql/item.cc:151
#8 0x000055ef969b8aef in Item::val_datetime_packed (this=0x7efccc035158) at /10.2/src/sql/item.h:1511
#9 0x000055ef96d4f39d in Item::val_temporal_packed (this=0x7efccc035158, f_type=MYSQL_TYPE_DATETIME) at /10.2/src/sql/item.h:1531
#10 0x000055ef96d59714 in Arg_comparator::compare_temporal (this=0x7efccc0353b0, type=MYSQL_TYPE_DATETIME) at /10.2/src/sql/item_cmpfunc.cc:792
#11 0x000055ef969a7aff in Arg_comparator::compare_datetime (this=0x7efccc0353b0) at /10.2/src/sql/item_cmpfunc.h:105
#12 0x000055ef96d6e554 in Arg_comparator::compare (this=0x7efccc0353b0) at /10.2/src/sql/item_cmpfunc.h:87
#13 0x000055ef96d5c9a7 in Item_func_eq::val_int (this=0x7efccc0352f0) at /10.2/src/sql/item_cmpfunc.cc:1806
#14 0x000055ef96ba6624 in TABLE::verify_constraints (this=0x7efccc175dc0, ignore_failure=false) at /10.2/src/sql/table.cc:5303
#15 0x000055ef96ba6517 in TABLE_LIST::view_check_option (this=0x7efccc0127e8, thd=0x7efccc000d90, ignore_failure=false) at /10.2/src/sql/table.cc:5280
#16 0x000055ef96a6df9e in mysql_insert (thd=0x7efccc000d90, table_list=0x7efccc0127e8, fields=..., values_list=..., update_fields=..., update_values=..., duplic=DUP_ERROR, ignore=false) at /10.2/src/sql/sql_insert.cc:1042
#17 0x000055ef96a95638 in mysql_execute_command (thd=0x7efccc000d90) at /10.2/src/sql/sql_parse.cc:4217
#18 0x000055ef96aa0b42 in mysql_parse (thd=0x7efccc000d90, rawbuf=0x7efccc012708 "INSERT t1 VALUES ( NULL , 0 )", length=29, parser_state=0x7efd22b99560, is_com_multi=false, is_next_command=false) at /10.2/src/sql/sql_parse.cc:7793
#19 0x000055ef96a8ed9d in dispatch_command (command=COM_QUERY, thd=0x7efccc000d90, packet=0x7efccc008b61 "INSERT t1 VALUES ( NULL , 0 ) ", packet_length=30, is_com_multi=false, is_next_command=false) at /10.2/src/sql/sql_parse.cc:1827
#20 0x000055ef96a8d898 in do_command (thd=0x7efccc000d90) at /10.2/src/sql/sql_parse.cc:1381
#21 0x000055ef96be9661 in do_handle_one_connection (connect=0x55ef99309d10) at /10.2/src/sql/sql_connect.cc:1336
#22 0x000055ef96be93c6 in handle_one_connection (arg=0x55ef99309d10) at /10.2/src/sql/sql_connect.cc:1241
#23 0x000055ef97412ec4 in pfs_spawn_thread (arg=0x55ef992ecfd0) at /10.2/src/storage/perfschema/pfs.cc:1869
#24 0x00007efd28d74609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#25 0x00007efd2894f293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Alice Sherepa added a comment - 2021-08-25 09:12 - edited test case from MDEV-26435 , with ALTER CREATE TABLE t1 ( v1 TIMESTAMP ) ; ALTER TABLE t1 ADD COLUMN t1 TEXT DEFAULT ( DEFAULT ( v1 ) ) ; 10.2 1f1d5606e08c928e3da98b #3 <signal handler called> #4 Field::set_default (this=0x7fb774038f58) at /10.2/src/sql/field.cc:2457 #5 0x0000564d85bd09a1 in Item_default_value::calculate (this=0x7fb774038e48) at /10.2/src/sql/item.cc:9040 #6 0x0000564d85bd0b53 in Item_default_value::save_in_field (this=0x7fb774038e48, field_arg=0x7fb774037ba8, no_conversions=false) at /10.2/src/sql/item.cc:9084 #7 0x0000564d85a35bc0 in TABLE::update_default_fields (this=0x7fb774036ea0, ignore_errors=true) at /10.2/src/sql/table.cc:7879 #8 0x0000564d859f8bb7 in mysql_alter_table (thd=0x7fb774000d90, new_db=0x7fb774012e48 "test", new_name=0x0, create_info=0x7fb7c2038250, table_list=0x7fb774012828, alter_info=0x7fb7c20381a0, order_num=0, order=0x0, ignore=false) at /10.2/src/sql/sql_table.cc:9609 #9 0x0000564d85a77c6c in Sql_cmd_alter_table::execute (this=0x7fb774013180, thd=0x7fb774000d90) at /10.2/src/sql/sql_alter.cc:333 #10 0x0000564d85924cdc in mysql_execute_command (thd=0x7fb774000d90) at /10.2/src/sql/sql_parse.cc:6017 #11 0x0000564d85929b42 in mysql_parse (thd=0x7fb774000d90, rawbuf=0x7fb774012708 "ALTER TABLE t1 ADD COLUMN t1 TEXT DEFAULT ( DEFAULT ( v1 ) )", length=60, parser_state=0x7fb7c2039560, is_com_multi=false, is_next_command=false) at /10.2/src/sql/sql_parse.cc:7793 #12 0x0000564d85917d9d in dispatch_command (command=COM_QUERY, thd=0x7fb774000d90, packet=0x7fb774008b61 "ALTER TABLE t1 ADD COLUMN t1 TEXT DEFAULT ( DEFAULT ( v1 ) ) ", packet_length=61, is_com_multi=false, is_next_command=false) at /10.2/src/sql/sql_parse.cc:1827 #13 0x0000564d85916898 in do_command (thd=0x7fb774000d90) at /10.2/src/sql/sql_parse.cc:1381 #14 0x0000564d85a72661 in do_handle_one_connection (connect=0x564d896e1d30) at /10.2/src/sql/sql_connect.cc:1336 #15 0x0000564d85a723c6 in handle_one_connection (arg=0x564d896e1d30) at /10.2/src/sql/sql_connect.cc:1241 #16 0x0000564d8629bec4 in pfs_spawn_thread (arg=0x564d896c4ff0) at /10.2/src/storage/perfschema/pfs.cc:1869 #17 0x00007fb7c8214609 in start_thread (arg=<optimized out>) at pthread_create.c:477 #18 0x00007fb7c7def293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 from MDEV-26430 CREATE TABLE t1 (v1 TIMESTAMP , a INT NULL CHECK (ceil( DEFAULT (v1)) = NULL )) ; INSERT t1 VALUES ( NULL ,0) ; 10.2 1f1d5606e08c928e3da98b #3 <signal handler called> #4 Field::set_default (this=0x7f833c035440) at /10.2/src/sql/field.cc:2457 #5 0x0000558dc2f009a1 in Item_default_value::calculate (this=0x7f833c035158) at /10.2/src/sql/item.cc:9040 #6 0x0000558dc2f00a34 in Item_default_value::val_real (this=0x7f833c035158) at /10.2/src/sql/item.cc:9052 #7 0x0000558dc2f548bc in Item_func_ceiling::real_op (this=0x7f833c0352b8) at /10.2/src/sql/item_func.cc:2382 #8 0x0000558dc2f5484a in Item_func_ceiling::int_op (this=0x7f833c0352b8) at /10.2/src/sql/item_func.cc:2370 #9 0x0000558dc2f4ea08 in Item_func_hybrid_field_type::val_real (this=0x7f833c0352b8) at /10.2/src/sql/item_func.cc:905 #10 0x0000558dc2f1304c in Arg_comparator::compare_real_fixed (this=0x7f833c035678) at /10.2/src/sql/item_cmpfunc.cc:934 #11 0x0000558dc2f27554 in Arg_comparator::compare (this=0x7f833c035678) at /10.2/src/sql/item_cmpfunc.h:87 #12 0x0000558dc2f159a7 in Item_func_eq::val_int (this=0x7f833c0355b8) at /10.2/src/sql/item_cmpfunc.cc:1806 #13 0x0000558dc2d5f624 in TABLE::verify_constraints (this=0x7f833c175dc0, ignore_failure=false) at /10.2/src/sql/table.cc:5303 #14 0x0000558dc2d5f517 in TABLE_LIST::view_check_option (this=0x7f833c0127e8, thd=0x7f833c000d90, ignore_failure=false) at /10.2/src/sql/table.cc:5280 #15 0x0000558dc2c26f9e in mysql_insert (thd=0x7f833c000d90, table_list=0x7f833c0127e8, fields=..., values_list=..., update_fields=..., update_values=..., duplic=DUP_ERROR, ignore=false) at /10.2/src/sql/sql_insert.cc:1042 #16 0x0000558dc2c4e638 in mysql_execute_command (thd=0x7f833c000d90) at /10.2/src/sql/sql_parse.cc:4217 #17 0x0000558dc2c59b42 in mysql_parse (thd=0x7f833c000d90, rawbuf=0x7f833c012708 "INSERT t1 VALUES (NULL ,0)", length=26, parser_state=0x7f839446a560, is_com_multi=false, is_next_command=false) at /10.2/src/sql/sql_parse.cc:7793 #18 0x0000558dc2c47d9d in dispatch_command (command=COM_QUERY, thd=0x7f833c000d90, packet=0x7f833c008b61 "INSERT t1 VALUES (NULL ,0) ", packet_length=27, is_com_multi=false, is_next_command=false) at /10.2/src/sql/sql_parse.cc:1827 #19 0x0000558dc2c46898 in do_command (thd=0x7f833c000d90) at /10.2/src/sql/sql_parse.cc:1381 #20 0x0000558dc2da2661 in do_handle_one_connection (connect=0x558dc5689d10) at /10.2/src/sql/sql_connect.cc:1336 #21 0x0000558dc2da23c6 in handle_one_connection (arg=0x558dc5689d10) at /10.2/src/sql/sql_connect.cc:1241 #22 0x0000558dc35cbec4 in pfs_spawn_thread (arg=0x558dc566cfd0) at /10.2/src/storage/perfschema/pfs.cc:1869 #23 0x00007f8399de5609 in start_thread (arg=<optimized out>) at pthread_create.c:477 #24 0x00007f83999c0293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 CREATE TABLE t1 ( v1 TIMESTAMP , a INT CHECK ( DEFAULT (v1) = NULL ) ) ; INSERT t1 VALUES ( NULL , 0 ) ; 10.2 1f1d5606e08c928e3da98b #3 <signal handler called> #4 Field::set_default (this=0x7efccc0355b8) at /10.2/src/sql/field.cc:2457 #5 0x000055ef96d479a1 in Item_default_value::calculate (this=0x7efccc035158) at /10.2/src/sql/item.cc:9040 #6 0x000055ef96d47ac6 in Item_default_value::get_date (this=0x7efccc035158, ltime=0x7efd22b98270, fuzzydate=33554433) at /10.2/src/sql/item.cc:9070 #7 0x000055ef96d2dfc6 in Item::get_date_with_conversion (this=0x7efccc035158, ltime=0x7efd22b98270, fuzzydate=33554433) at /10.2/src/sql/item.cc:151 #8 0x000055ef969b8aef in Item::val_datetime_packed (this=0x7efccc035158) at /10.2/src/sql/item.h:1511 #9 0x000055ef96d4f39d in Item::val_temporal_packed (this=0x7efccc035158, f_type=MYSQL_TYPE_DATETIME) at /10.2/src/sql/item.h:1531 #10 0x000055ef96d59714 in Arg_comparator::compare_temporal (this=0x7efccc0353b0, type=MYSQL_TYPE_DATETIME) at /10.2/src/sql/item_cmpfunc.cc:792 #11 0x000055ef969a7aff in Arg_comparator::compare_datetime (this=0x7efccc0353b0) at /10.2/src/sql/item_cmpfunc.h:105 #12 0x000055ef96d6e554 in Arg_comparator::compare (this=0x7efccc0353b0) at /10.2/src/sql/item_cmpfunc.h:87 #13 0x000055ef96d5c9a7 in Item_func_eq::val_int (this=0x7efccc0352f0) at /10.2/src/sql/item_cmpfunc.cc:1806 #14 0x000055ef96ba6624 in TABLE::verify_constraints (this=0x7efccc175dc0, ignore_failure=false) at /10.2/src/sql/table.cc:5303 #15 0x000055ef96ba6517 in TABLE_LIST::view_check_option (this=0x7efccc0127e8, thd=0x7efccc000d90, ignore_failure=false) at /10.2/src/sql/table.cc:5280 #16 0x000055ef96a6df9e in mysql_insert (thd=0x7efccc000d90, table_list=0x7efccc0127e8, fields=..., values_list=..., update_fields=..., update_values=..., duplic=DUP_ERROR, ignore=false) at /10.2/src/sql/sql_insert.cc:1042 #17 0x000055ef96a95638 in mysql_execute_command (thd=0x7efccc000d90) at /10.2/src/sql/sql_parse.cc:4217 #18 0x000055ef96aa0b42 in mysql_parse (thd=0x7efccc000d90, rawbuf=0x7efccc012708 "INSERT t1 VALUES ( NULL , 0 )", length=29, parser_state=0x7efd22b99560, is_com_multi=false, is_next_command=false) at /10.2/src/sql/sql_parse.cc:7793 #19 0x000055ef96a8ed9d in dispatch_command (command=COM_QUERY, thd=0x7efccc000d90, packet=0x7efccc008b61 "INSERT t1 VALUES ( NULL , 0 ) ", packet_length=30, is_com_multi=false, is_next_command=false) at /10.2/src/sql/sql_parse.cc:1827 #20 0x000055ef96a8d898 in do_command (thd=0x7efccc000d90) at /10.2/src/sql/sql_parse.cc:1381 #21 0x000055ef96be9661 in do_handle_one_connection (connect=0x55ef99309d10) at /10.2/src/sql/sql_connect.cc:1336 #22 0x000055ef96be93c6 in handle_one_connection (arg=0x55ef99309d10) at /10.2/src/sql/sql_connect.cc:1241 #23 0x000055ef97412ec4 in pfs_spawn_thread (arg=0x55ef992ecfd0) at /10.2/src/storage/perfschema/pfs.cc:1869 #24 0x00007efd28d74609 in start_thread (arg=<optimized out>) at pthread_create.c:477 #25 0x00007efd2894f293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Alice Sherepa added a comment - 2021-08-24 16:59

test case from ~~MDEV-26436~~, which repeats the problem starting from 10.2:

CREATE TABLE t1 (v2 DATE CHECK (v1 like DEFAULT (v1)), v1 DATE DEFAULT (FROM_DAYS ('x')));

INSERT IGNORE INTO t1 VALUES ( 'x' , 'x' ) ;

10.2 1f1d5606e08c928e3da98b
210824 18:56:05 [ERROR] mysqld got signal 11 ;
Server version: 10.2.41-MariaDB-debug-log

sigaction.c:0(__restore_rt)[0x7f69a711a3c0]
sql/field.cc:2457(Field::set_default())[0x5574ce5bcb1d]
sql/item.cc:9041(Item_default_value::calculate())[0x5574ce61b9a1]
sql/item.cc:9047(Item_default_value::val_str(String*))[0x5574ce61ba02]
sql/item_cmpfunc.cc:5276(Item_func_like::val_int())[0x5574ce63bf9e]
sql/table.cc:5303(TABLE::verify_constraints(bool))[0x5574ce47a624]
sql/table.cc:5280(TABLE_LIST::view_check_option(THD*, bool))[0x5574ce47a517]
sql/sql_insert.cc:1042(mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool))[0x5574ce341f9e]
sql/sql_parse.cc:4217(mysql_execute_command(THD*))[0x5574ce369638]
sql/sql_parse.cc:7793(mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool))[0x5574ce374b42]
sql/sql_parse.cc:1830(dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool))[0x5574ce362d9d]
sql/sql_parse.cc:1381(do_command(THD*))[0x5574ce361898]
sql/sql_connect.cc:1336(do_handle_one_connection(CONNECT*))[0x5574ce4bd661]
sql/sql_connect.cc:1242(handle_one_connection)[0x5574ce4bd3c6]
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x5574cece6ec4]
nptl/pthread_create.c:478(start_thread)[0x7f69a710e609]
x86_64/clone.S:97(__GI___clone)[0x7f69a6ce9293]

Query (0x7f6950012708): INSERT IGNORE INTO t1 VALUES ( 'x' , 'x' )

and also all similar cases, e.g

CREATE TABLE t1 (v2 DATE CHECK (v1 = DEFAULT (v1)), v1 DATE DEFAULT (FROM_DAYS ('x')));

INSERT IGNORE INTO t1 VALUES ( 'x' , 'x' ) ;

10.2 1f1d5606e08c928e3da98b
210824 18:57:05 [ERROR] mysqld got signal 11 ;

Server version: 10.2.41-MariaDB-debug-log

sigaction.c:0(__restore_rt)[0x7fd7e0c813c0]
sql/field.cc:2457(Field::set_default())[0x55bae1298b1d]
sql/item.cc:9041(Item_default_value::calculate())[0x55bae12f79a1]
sql/item.cc:9071(Item_default_value::get_date(st_mysql_time*, unsigned long long))[0x55bae12f7ac6]
sql/item.cc:151(Item::get_date_with_conversion(st_mysql_time*, unsigned long long))[0x55bae12ddfc6]
sql/item.h:1511(Item::val_datetime_packed())[0x55bae0f68aef]
sql/item.h:1532(Item::val_temporal_packed(enum_field_types))[0x55bae12ff39d]
sql/item_cmpfunc.cc:797(Arg_comparator::compare_temporal(enum_field_types))[0x55bae1309749]
sql/item_cmpfunc.h:105(Arg_comparator::compare_datetime())[0x55bae0f57aff]
sql/item_cmpfunc.h:87(Arg_comparator::compare())[0x55bae131e554]
sql/item_cmpfunc.cc:1806(Item_func_eq::val_int())[0x55bae130c9a7]
sql/table.cc:5303(TABLE::verify_constraints(bool))[0x55bae1156624]
sql/table.cc:5280(TABLE_LIST::view_check_option(THD*, bool))[0x55bae1156517]
sql/sql_insert.cc:1042(mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool))[0x55bae101df9e]
sql/sql_parse.cc:4217(mysql_execute_command(THD*))[0x55bae1045638]
sql/sql_parse.cc:7793(mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool))[0x55bae1050b42]
sql/sql_parse.cc:1830(dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool))[0x55bae103ed9d]
sql/sql_parse.cc:1381(do_command(THD*))[0x55bae103d898]
sql/sql_connect.cc:1336(do_handle_one_connection(CONNECT*))[0x55bae1199661]
sql/sql_connect.cc:1242(handle_one_connection)[0x55bae11993c6]
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55bae19c2ec4]
nptl/pthread_create.c:478(start_thread)[0x7fd7e0c75609]
x86_64/clone.S:97(__GI___clone)[0x7fd7e0850293]

Query (0x7fd78c012708): INSERT IGNORE INTO t1 VALUES ( 'x' , 'x' )

Alice Sherepa added a comment - 2021-08-24 16:59 test case from MDEV-26436 , which repeats the problem starting from 10.2: CREATE TABLE t1 (v2 DATE CHECK (v1 like DEFAULT (v1)), v1 DATE DEFAULT (FROM_DAYS ( 'x' ))); INSERT IGNORE INTO t1 VALUES ( 'x' , 'x' ) ; 10.2 1f1d5606e08c928e3da98b 210824 18:56:05 [ERROR] mysqld got signal 11 ; Server version: 10.2.41-MariaDB-debug-log sigaction.c:0(__restore_rt)[0x7f69a711a3c0] sql/field.cc:2457(Field::set_default())[0x5574ce5bcb1d] sql/item.cc:9041(Item_default_value::calculate())[0x5574ce61b9a1] sql/item.cc:9047(Item_default_value::val_str(String*))[0x5574ce61ba02] sql/item_cmpfunc.cc:5276(Item_func_like::val_int())[0x5574ce63bf9e] sql/table.cc:5303(TABLE::verify_constraints(bool))[0x5574ce47a624] sql/table.cc:5280(TABLE_LIST::view_check_option(THD*, bool))[0x5574ce47a517] sql/sql_insert.cc:1042(mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool))[0x5574ce341f9e] sql/sql_parse.cc:4217(mysql_execute_command(THD*))[0x5574ce369638] sql/sql_parse.cc:7793(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x5574ce374b42] sql/sql_parse.cc:1830(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x5574ce362d9d] sql/sql_parse.cc:1381(do_command(THD*))[0x5574ce361898] sql/sql_connect.cc:1336(do_handle_one_connection(CONNECT*))[0x5574ce4bd661] sql/sql_connect.cc:1242(handle_one_connection)[0x5574ce4bd3c6] perfschema/pfs.cc:1871(pfs_spawn_thread)[0x5574cece6ec4] nptl/pthread_create.c:478(start_thread)[0x7f69a710e609] x86_64/clone.S:97(__GI___clone)[0x7f69a6ce9293] Query (0x7f6950012708): INSERT IGNORE INTO t1 VALUES ( 'x' , 'x' ) and also all similar cases, e.g CREATE TABLE t1 (v2 DATE CHECK (v1 = DEFAULT (v1)), v1 DATE DEFAULT (FROM_DAYS ( 'x' ))); INSERT IGNORE INTO t1 VALUES ( 'x' , 'x' ) ; 10.2 1f1d5606e08c928e3da98b 210824 18:57:05 [ERROR] mysqld got signal 11 ; Server version: 10.2.41-MariaDB-debug-log sigaction.c:0(__restore_rt)[0x7fd7e0c813c0] sql/field.cc:2457(Field::set_default())[0x55bae1298b1d] sql/item.cc:9041(Item_default_value::calculate())[0x55bae12f79a1] sql/item.cc:9071(Item_default_value::get_date(st_mysql_time*, unsigned long long))[0x55bae12f7ac6] sql/item.cc:151(Item::get_date_with_conversion(st_mysql_time*, unsigned long long))[0x55bae12ddfc6] sql/item.h:1511(Item::val_datetime_packed())[0x55bae0f68aef] sql/item.h:1532(Item::val_temporal_packed(enum_field_types))[0x55bae12ff39d] sql/item_cmpfunc.cc:797(Arg_comparator::compare_temporal(enum_field_types))[0x55bae1309749] sql/item_cmpfunc.h:105(Arg_comparator::compare_datetime())[0x55bae0f57aff] sql/item_cmpfunc.h:87(Arg_comparator::compare())[0x55bae131e554] sql/item_cmpfunc.cc:1806(Item_func_eq::val_int())[0x55bae130c9a7] sql/table.cc:5303(TABLE::verify_constraints(bool))[0x55bae1156624] sql/table.cc:5280(TABLE_LIST::view_check_option(THD*, bool))[0x55bae1156517] sql/sql_insert.cc:1042(mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool))[0x55bae101df9e] sql/sql_parse.cc:4217(mysql_execute_command(THD*))[0x55bae1045638] sql/sql_parse.cc:7793(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55bae1050b42] sql/sql_parse.cc:1830(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55bae103ed9d] sql/sql_parse.cc:1381(do_command(THD*))[0x55bae103d898] sql/sql_connect.cc:1336(do_handle_one_connection(CONNECT*))[0x55bae1199661] sql/sql_connect.cc:1242(handle_one_connection)[0x55bae11993c6] perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55bae19c2ec4] nptl/pthread_create.c:478(start_thread)[0x7fd7e0c75609] x86_64/clone.S:97(__GI___clone)[0x7fd7e0850293] Query (0x7fd78c012708): INSERT IGNORE INTO t1 VALUES ( 'x' , 'x' )

Alice Sherepa added a comment - 2021-07-01 08:04

Thank you!
Repeatable on 10.3-10.6:

CREATE TABLE t1 (d timestamp CHECK (DEFAULT (d) is true)) AS SELECT 1;

10.3 29098083f7ac3b445ee59c3e765eb6
Version: '10.3.31-MariaDB-debug-log'
210701 10:01:18 [ERROR] mysqld got signal 11 ;

sigaction.c:0(__restore_rt)[0x7f19466823c0]
sql/field.cc:2420(Field::set_default())[0x55d4807c0aba]
sql/item.cc:9429(Item_default_value::calculate())[0x55d4808ff2dc]
sql/item.cc:9441(Item_default_value::val_real())[0x55d4808ff402]
sql/sql_type.cc:3302(Type_handler_temporal_result::Item_val_bool(Item*) const)[0x55d4806026f0]
sql/item.h:1220(Item::val_bool())[0x55d47fe65c74]
sql/item_cmpfunc.cc:1151(Item_func_truth::val_bool())[0x55d48092bfaf]
sql/item_cmpfunc.cc:1174(Item_func_truth::val_int())[0x55d48092c1d4]
sql/table.cc:5409(TABLE::verify_constraints(bool))[0x55d4803f54fe]
sql/table.cc:5384(TABLE_LIST::view_check_option(THD*, bool))[0x55d4803f50b9]
sql/sql_insert.cc:3931(select_insert::send_data(List<Item>&))[0x55d480068266]
sql/sql_select.cc:4012(JOIN::exec_inner())[0x55d4801bb916]
sql/sql_select.cc:3933(JOIN::exec())[0x55d4801ba6a4]
sql/sql_select.cc:4342(mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex))[0x55d4801be18c]
sql/sql_select.cc:372(handle_select(THD, LEX, select_result*, unsigned long))[0x55d480194aeb]
sql/sql_table.cc:11337(Sql_cmd_create_table_like::execute(THD*))[0x55d48035fc1b]
sql/sql_parse.cc:6075(mysql_execute_command(THD*))[0x55d480103c35]
sql/sql_parse.cc:7870(mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool))[0x55d48010ff60]
sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool))[0x55d4800e6e31]
sql/sql_parse.cc:1398(do_command(THD*))[0x55d4800e3974]
sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x55d4804b18b7]
sql/sql_connect.cc:1309(handle_one_connection)[0x55d4804b1171]
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55d481ae3e01]
nptl/pthread_create.c:478(start_thread)[0x7f1946676609]
x86_64/clone.S:97(__GI___clone)[0x7f194659d293]

Query (0x62b000000410): CREATE TABLE t1 (d timestamp CHECK (DEFAULT (d) is true)) AS SELECT 1

Alice Sherepa added a comment - 2021-07-01 08:04 Thank you! Repeatable on 10.3-10.6: CREATE TABLE t1 (d timestamp CHECK ( DEFAULT (d) is true )) AS SELECT 1; 10.3 29098083f7ac3b445ee59c3e765eb6 Version: '10.3.31-MariaDB-debug-log' 210701 10:01:18 [ERROR] mysqld got signal 11 ; sigaction.c:0(__restore_rt)[0x7f19466823c0] sql/field.cc:2420(Field::set_default())[0x55d4807c0aba] sql/item.cc:9429(Item_default_value::calculate())[0x55d4808ff2dc] sql/item.cc:9441(Item_default_value::val_real())[0x55d4808ff402] sql/sql_type.cc:3302(Type_handler_temporal_result::Item_val_bool(Item*) const)[0x55d4806026f0] sql/item.h:1220(Item::val_bool())[0x55d47fe65c74] sql/item_cmpfunc.cc:1151(Item_func_truth::val_bool())[0x55d48092bfaf] sql/item_cmpfunc.cc:1174(Item_func_truth::val_int())[0x55d48092c1d4] sql/table.cc:5409(TABLE::verify_constraints(bool))[0x55d4803f54fe] sql/table.cc:5384(TABLE_LIST::view_check_option(THD*, bool))[0x55d4803f50b9] sql/sql_insert.cc:3931(select_insert::send_data(List<Item>&))[0x55d480068266] sql/sql_select.cc:4012(JOIN::exec_inner())[0x55d4801bb916] sql/sql_select.cc:3933(JOIN::exec())[0x55d4801ba6a4] sql/sql_select.cc:4342(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55d4801be18c] sql/sql_select.cc:372(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55d480194aeb] sql/sql_table.cc:11337(Sql_cmd_create_table_like::execute(THD*))[0x55d48035fc1b] sql/sql_parse.cc:6075(mysql_execute_command(THD*))[0x55d480103c35] sql/sql_parse.cc:7870(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55d48010ff60] sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55d4800e6e31] sql/sql_parse.cc:1398(do_command(THD*))[0x55d4800e3974] sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x55d4804b18b7] sql/sql_connect.cc:1309(handle_one_connection)[0x55d4804b1171] perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55d481ae3e01] nptl/pthread_create.c:478(start_thread)[0x7f1946676609] x86_64/clone.S:97(__GI___clone)[0x7f194659d293] Query (0x62b000000410): CREATE TABLE t1 (d timestamp CHECK (DEFAULT (d) is true)) AS SELECT 1

People

Assignee:: Sergei Golubchik

Reporter:: yaoguang

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 2021-07-01 02:40

Updated:: 2022-04-14 13:45

Resolved:: 2022-04-14 13:45

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.